Troubleshooting

Change collection intervals

Change collection intervals in order to reduce the load on your Data Collection Nodes (DCNs) and your vCenters.

Change the time interval for your host inventory job.

On the instance where your scheduler is running, navigate to \etc\apps\Splunk_TA_vmware\default\.

Open the ta_vmware_collection.conf file.

Change hostinv_interval and hostinv_expiration from the 900 second default to a larger number (maximum 2700 seconds). Keep hostinv_interval and hostinv_expiration at the same number of seconds.

Save your changes and exit.

Change the time interval for host performance data.

On the instance where your scheduler is running, navigate to \etc\apps\Splunk_TA_vmware\local\.

Open the ta_vmware_collection.conf file.

Change hostvmperf_interval and hostvmperf_expiration from the 180 second default to a larger number (maximum 1200 seconds). Keep hostvmperf_interval and hostvmperf_expiration at the same number of seconds.

Save your changes and exit.

Change the NTP server pool list

A computer uses the Network Time Protocol (NTP) to synchronize its time with another reference time source. If you are experiencing time synchronization issues between the indexer, DCN, and vCenter Server, you can change the NTP servers that the DCN uses by editing the /etc/ntp.conf file.

Access the /etc/ntp.conf file. The following values are defaults for the servers in the file.

Disable NTP on the data collection node

If your firewall prevents Internet access, you can disable NTP on the data collection node. If you disable NTP, enable VMware Tools Clock Synchronization which establishes the time for the DCN using the ESXi host.

1. Log in to Splunk Enterprise as a splunk user.

2. Stop the ntpd service using the following command: sudo service ntpd stop

3. Configure ntpd so that it does not run when the system starts: sudo chkconfig ntpd off

As of version 6.0 VMware vCenter has added a limitation to the number of performance metrics collected by the vpxd.stats.maxQueryMetrics function. The vCenter 6.0 maxQuerySize limit is 64 metrics per query. This 64 metric limit is calculated by mulltiplying the number of metrics queried by the number of entities (virtual machines) being queried. For example, querying 8 entities (virtual machines) for 10 metrics from each entity (virtual machine) equals a query size of 80.

To adjust the maxQuerySize limit:

Navigate to the advanced settings of vCenter Server, or vCenter Server Appliance.

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »